Skip to content
Permalink
Browse files
8238842: AIOOBE in GIFImageReader.initializeStringTable
Reviewed-by: serb, bpb
  • Loading branch information
Phil Race committed Feb 12, 2020
1 parent dfaaec9 commit ff55c4903baf954c684902dedc63b8b778321c32
Showing with 56 additions and 1 deletion.
  1. +4 −1 src/java.desktop/share/classes/com/sun/imageio/plugins/gif/GIFImageReader.java
  2. +52 −0 test/jdk/javax/imageio/plugins/gif/GIFCodeSizeTest.java
@@ -919,6 +919,10 @@ public BufferedImage read(int imageIndex, ImageReadParam param)
try {
// Read and decode the image data, fill in theImage
this.initCodeSize = stream.readUnsignedByte();
// GIF allows max 8 bpp, so anything larger is bogus for the roots.
if (this.initCodeSize < 1 || this.initCodeSize > 8) {
throw new IIOException("Bad code size:" + this.initCodeSize);
}

// Read first data block
this.blockLength = stream.readUnsignedByte();
@@ -1017,7 +1021,6 @@ public BufferedImage read(int imageIndex, ImageReadParam param)
processReadAborted();
return theImage;
} catch (IOException e) {
e.printStackTrace();
throw new IIOException("I/O error reading image!", e);
}
}
@@ -0,0 +1,52 @@
/*
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

/**
* @test
* @bug 8238842
* @summary Test incorrect code size results in IOException
*/

import java.io.ByteArrayInputStream;
import java.io.IOException;
import javax.imageio.ImageIO;

public class GIFCodeSizeTest {

static final byte[] DATA = {
(byte)0x47, (byte)0x49, (byte)0x46, (byte)0x38, (byte)0x37,
(byte)0x61, (byte)0x02, (byte)0x00, (byte)0x02, (byte)0x00,
(byte)0x80, (byte)0x00, (byte)0x80, (byte)0x00, (byte)0xff,
(byte)0xff, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x2c,
(byte)0x00, (byte)0x00, (byte)0x01, (byte)0x00, (byte)0x02,
(byte)0x00, (byte)0x02, (byte)0x00, (byte)0x00, (byte)0x12,
(byte)0x02, (byte)0x84, (byte)0x51, (byte)0x00, (byte)0x3b
};

public static void main(String[] args) /*throws Exception */{
try {
ImageIO.read(new ByteArrayInputStream(DATA));
} catch (IOException e) {
}
}
}

0 comments on commit ff55c49

Please sign in to comment.